skill-privacy-guard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate privacy purpose, but it tries to automatically run and rewrite skill files too broadly without clear user approval.

Install only if you are comfortable with a skill that may run during skill editing and rewrite files automatically. Prefer using it in dry-run or review mode, with explicit user approval before applying changes, because its broad patterns can remove legitimate examples, identifiers, dates, hashes, or configuration details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:3

Finding

Automatic Priority Override and Unauthorized Skill Rewriting

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Auto-triggering after creating or editing any skill file gives this skill blanket authority to inspect and rewrite unrelated content, far beyond a narrowly scoped user action. In context, that broad activation is especially dangerous because the skill performs automatic scanning and write-back, which can silently alter files, remove legitimate data, or interfere with other skills' behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 66)May include surrounding context.

md

**NEVER INCLUDE - Remove immediately:**

- API keys (AWS, Google, etc.)
- Access tokens (Bearer, OAuth)
- Passwords, passphrases
- Private keys (SSH, SSL/TLS)
- Certificates

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "clean skill" is broad and semantically close to common editing or refactoring requests, so it can cause the skill to activate when the user did not specifically request sanitization. Because this skill is designed to rewrite files, accidental activation can lead to unintended content modification or destructive over-sanitization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description emphasizes privacy protection but does not clearly disclose that it may automatically rewrite skill files after detecting patterns. That mismatch reduces informed consent and can mislead users or downstream agents about the operational risk of using the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 301)May include surrounding context.

Step 3: Apply Replacements

Create a sanitized version with:

Path replacements:

text

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This instruction imposes one filesystem notation style across outputs regardless of user platform or preference. That is a natural-language policy concern because it forces a specific representation without opt-in or a documented justification tied to a defined environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.